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The engine that powers quantum cryptography is the principle that there are no physical means 
for gathering information about the identity of a quantum system's state (when it is Icnown to be 
prepared in one of a set of nonorthogonal states) without disturbing the system in a statistically 
detectable way. This situation is often mistakenly described as a consequence of the "Heisenberg 
uncertainty principle." A more accurate account is that it is a unique feature of quantum phenomena 
that rests ultimately on the Hilbert space structure of the theory along with the fact that time 
evolutions for isolated systems are unitary. In this paper we shall explore several aspects of the 
information-disturbance principle in an attempt to make it firmly quantitative and flesh out its 
significance for quantum theory as a whole. 
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1 Introduction 

Suppose an observer obtains a quantum system secretly 
prepared in one of two nonorthogonal pure quantum 
states. Quantum theory dictates that there is no mea- 
surement he can use to certify which of the two states was 
actually prepared. This is well known and rcfs]. A 
simple, but less recognized, corollary is that no interaction 
used for performing such an information-gathering mea- 
surement can leave both states unchanged in the process 
If the observer could completely regenerate the un- 
known quantum state after measurement, then — by mak- 
ing further nondisturbing information-gathering measure- 
ments on it — he would eventually be able to infer the 
state's identity after all.[| 

This consistency argument is enough to establish a ten- 
sion between information gain and disturbance in quan- 
tum theory. What it does not capture, however, is the 
extent of the tradeoff between these two quantities. In 
this paper, we shall lay the groundwork for a quantita- 
tive study that goes beyond the qualitative nature of this 
tension. Namely, we will show how to capture in a for- 
mal way the idea that, depending upon the particular 
measurement interaction, there can be a tradeoff between 
the disturbance of the quantum states and the acquired 
ability to make inferences about their identity. We shall 
also explore the extent to which the very existence of this 
tradeoff can be taken as a fundamental principle of quan- 
tum theory — one from which unitary time evolution itself 
might possibly be derived. 



The plan of the paper is as follows. In the next Sec- 
tion, we lay out a general model (inspired by quantum 
cryptography |^]) upon which to formalize various no- 
tions of the information-disturbance tradeoff. Section 3 
places these ideas within the historical context, comparing 
them to the standard folklore that quantum mechanical 
measurements cause "uncontrollable disturbances" and 
do so because of the Heisenberg uncertainty principle jsj, 
p. 445]. In Section 4, we carry out the calculations neces- 
sary to develop one particularly simple tradeoff relation 
for pure quantum states; this example captures much of 
the essential physics of the problem. In Section 5, we say 
what little can be said presently about quantitative trade- 
off relations for mixed states. In particular, we point out 
how a "no-cloning" theorem does not capture the essence 
of the problem for mixed states. In Section 6, we describe 
a sense in which Wigner's theorem |42, a] allows the stan- 
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dard axiom of unitarity for quantum mechanical evolu- 
tions to be replaced with the ostensibly weaker one that 
"eavesdropping on nonorthogonal quantum states causes 
a disturbance." 



2 The Model 

The model we shall base our considerations on is most 
easily described in terms borrowed from quantum cryp- 
tography, from whence it takes its origin. Alice randomly 
prepares a quantum system to be in either a state po or a 
state pi. These states, in the most general setting, are de- 
scribed by density operators on an iV-dimensional Hilbert 
space for some N; there is no restriction that they be 
pure states, orthogonal, or commuting for that matter. 
After the preparation, the quantum system is passed into 
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a "black box" where it may be probed by an eavesdropper 
Eve in any way allowed by the laws of quantum mechan- 
ics. That is to say, Eve may allow the system to interact 
with an auxiliary system (which we shall call her probe) — 
leaving the probe ultimately in one of two states Pq or 
pf — so that after the systems have decoupled, she may 
perform quantum mechanical measurements on the probe 
itself. Because the outcome statistics of the measurement 
will then be conditioned upon the quantum state that 
went into the black box, the measurement may provide 
Eve with some information about the quantum state and 
may even provide her a basis on which to make an in- 
ference as to the state's identity. After this manhandling 
by Eve, the original quantum system is passed out of the 
black box and back into the possession of Alice.| 

A crucial aspect of this model is that even if Alice knows 
the exact manner in which Eve operates — i.e., her probe's 
initial state and the precise interaction she uses — because 
the system will have become entangled^ with the probe, 
she will necessarily have to resort to a new description 
of the quantum system after it emerges from the black 
box, say by some Pq or p*. That is to say, even if Alice 
sends a pure state into the black box, a pure state will not 
emerge out of it; rather it will be mixed. This is simply 
because, by assumption, Alice does not have access to all 
the relevant quantum systems. 

This is where the detail of our work begins. Eve now 
has the potential to gather information about identity of 
Alice's preparation, via the alternate states of her probe 
Pq or pf. Meanwhile the states po and pi no longer form 
valid descriptions of Alice's system because it will have 
become entangled with Eve's ancilla. 

The ingredients required to pose a precise tradeoff prin- 
ciple for information gain and disturbance follow from the 
setup of the model. We shall need: 

• a concise account of all probes and interactions that 
Eve may use to obtain evidence about the identity of 

the state 

• a convenient description of the most general kind of 
quantum measurement she may then perform on her 
probe 

• a measure of the information or inference power pro- 
vided by any given measurement. 



^In this respect, the model differs from the standard one in quan- 
tum key distribution. There, Eve eventually passes Alice's quantum 
system on to a third person Bob. Since we are not interested in key 
distribution per se in this work, such an extra participant would be 
superfluous. 

^The term "entanglement" was first used by Schrodinger ]36| 
soon after the EPR paper made its appearance. For historical 
interest, and for the purpose of bringing it to the attention of a wider 
audience, we point out that Einstein had a fairly clear notion of 
entanglement in his mind as early as 9 July 1931. This is evidenced 
by a letter from Ehrenfest to Bohr on that date. See Jammer's 
article l26| for details. 



• a good notion by which to measure the distinguisha- 
bility of mixed quantum states and a measure of dis- 
turbance based on it, and finally 

• a "figure of merit" by which to compare the distur- 
bance with the inference. 

We describe each of these ingredients in some detail in 
the subsections below. Finally in Section 2.5, we explore 
various ways of putting them together. 

2.1 Evolutions 

Since Eve cannot know which of the two quantum states 
Alice prepared, the most general manipulation she can 
perform on her newly acquired quantum system is to in- 
teract it with another system prepared independently of 
the particular state coming into the black box. Thus, if 
the state of the system entering the black box ps, s = 0,1, 
is a density operator on the Hilbert space Ha, the initial 
state of the joint system consisting of it and Eve's probe 
will he Ps ^ a for some standard density operator a on 
the probe's Hilbert space He- (There need be no a priori 
relation between the dimensionalities of Ti.A and H-e-) 

Interacting the two systems in the most controlled way 
that Eve possibly can, i.e., through some unitary inter- 
action U, leads to the two systems being entangled with 
only a single quantum state on Ha ®Ti.E between them: 



(1) 



After Alice's original system emerges from the black box 
and is placed back into her hands, her description of it 
will be 



p^ = tr^{pf) = tr^(u{ps^a)U^) , 



(2) 



where tr^ represents a partial trace over Eve's probe. The 
system in Eve's possession, will likewise afterward be de- 
scribed by a new density operator 



= tr,(pf) = tr,(L/(/5,®a)C/t) , 



(3) 



where tr^ represents a partial trace over Alice's system. 

The class of evolutions described by Eq. (||) are called 
"nonselective operations" by Kraus Note that if \Ei) 
is a basis in which the operator a is diagonal, then we 
may write Eq. (H) as 



(4) 



where aj are the eigenvalues of a. Letting the operators 
Aij on Ha be defined by 



A, 



/^{E,\U\E, 



(5) 
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and lumping the indexes, i.e., £ = we can write 

Eq. (I) as 

= (6) 

Note, furthermore, that the operators Ai satisfy the nor- 
malization condition 

I 

where I a is the identity operator on Ha- The content 
of Kraus's representation theorem is that any set of op- 
erators Ai satisfying Eq. (0) can be used in Eq. to 
describe a valid nonselective operation. (A simple proof 
of this theorem and a few others concerning nonselective 
operations can be found in Ref. [^.) 

The representation of a nonselective operation given by 
Eqs. (^) and (0) can be quite convenient because it gives a 
means of describing the evolution of Alice's system purely 
in terms of operators on her own Hilbert space Ti.A- 

2.2 Measurements 

The most general notion of measurement allowed within 
quantum mechanics is the POVM (short for Positive Op- 
erator-Valued Measure) |2^, These measurements 
can always be interpreted in terms of the standard von 
Neumann type if one is again willing to make use of an 
auxiliary system or ancilla. The idea is simple and much 
like that considered in the last subsection. Rather than 
making a von Neumann measurement on "He directly, 
there is nothing to stop Eve from first interacting her 
probe with some ancilla and then performing a standard 
measurement on the newly introduced ancilla. For in- 
stance, in this way. Eve can perform a valid quantum 
mechanical measurement on her probe with a cardinal- 
ity for the outcome set in excess of the dimensionality of 
TLe- Such a type of measurement is sometimes necessary 
for gaining the maximum information about a quantum 
state H, m. 

The nice thing about the formalism of POVMs is that 
this whole process can be described formally without ever 
making any mention of the extra ancilla. This can be seen 
as follows. Let CTc on Tic be the initial state of the new 
ancilla. After interacting the probe and the ancilla via 
some unitary interaction V , say, the state of the combined 
system will be V{p^ (g) ac)V'^ . If a von Neumann measure- 
ment is performed on the ancilla alone, there is some set 
of orthogonal projectors Ilf, on the ancilla's Hilbert space 
such that 

p,(6) =tr(t>(/5f ®<Tc)ft(/,®rib)) (8) 

is the probability of the various outcomes of that mea- 
surement. Here /e is the identity operator on TLe- 



Using the cyclic property of the trace function and split- 
ting the single trace into a piece over the probe and a piece 
over the ancilla, this becomes 

Ps{h) = tr^ ^/5^ trc((/E ® cr,)VHL ® ^b)v)^ ■ (9) 
Letting 

Eb = trc((/B ® <7c)T>^(/b ® fib)v) , (10) 
we obtain finally that 

Ps{b)=tr(p^Jb) . (11) 

As promised, all the operators in this expression refer to 
the probe's Hilbert space He- 

Note that the operators Eb are all nonnegative definite, 
i.e., 

(V'l^blV') > (12) 
for all and satisfy the completeness relation 

E^fa = /E. (13) 

b 

Any set of operators {Eb} satisfying these two properties 
is called a POVM. (This is because these two proper- 
ties are the natural generalization to the operator realm 
of the properties of a probability measure.) The POVM 
formulation of a measurement is particularly convenient 
for optimization problems because not only can POVMs 
be derived from specific measurement models but, con- 
versely, any set of operators {Eb} satisfying the definition 
of a POVM can be identified with a measurement proce- 
dure as described above ||2^ . This gives an easy algebraic 
characterization of all possible measurements. 

2.3 Information and Distinguishability 

There are several ways by which to quantify the "infor- 
mation" that Eve gathers about the identity of Alice's 
preparation. To say it another way, there are several mea- 
sures with which to gauge Eve's performance in learning 
the identity of ps- The best measure to use in a tradeoff 
relation is determined by Eve's particular needs. Will Eve 
be encountering one copy of Alice's system or many? If 
many, then will the systems be prepared the same each 
and every time, or rather will they be prepared randomly 
in one of the two possibilities at each shot? If the latter 
still, must Eve make an attempt to guess the identity of 
each state before she receives the next, or rather may she 
wait until very large blocks of data have been acquired? 
All these things and many more must be considered before 
choosing the exact measures for the relation. 

For specificity, we shall consider three information and 
distinguishability measures [llSl. All these measures, in 
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one sense or another, describe how much "information" 
can be gained about the identity of a quantum state. 
However, only one of the measures is truly information 
theoretic in the sense of Shannon's information theory 
p8[ . What is common to all three is that they each have 
the power to reveal the physics behind the idea that in- 
formation gain and state disturbance go hand in hand for 
quantum physics. 

Suppose Eve measures a POVM {Eb} on He- If 
Alice prepared po, the outcomes of Eve's measurement 
will occur with probabilities po{b) = tr{pQEt,)', if Alice 
prepared pi, the outcomes will occur with probabilities 
Pi{b) — tr(/5fi?f,). Given this measurement on Eve's part, 
the extent to which Alice's preparations can be distin- 
guished is exactly the extent to which the probability dis- 
tributions po{b) and pi{b) can be distinguished. 

A very simple measure of the distinguishability of pQ^b) 
and pi{b) is the statistical overlap between these distri- 
butions El: 



B{po,Pi) = ^ VpoWVPiW • 



(14) 



When there is no overlap between the distributions they 
can certainly be distinguished completely. Alternatively, 
the overlap is unity if and only if the distributions are 
identical and cannot be distinguished at all. Such a mea- 
sure of distinguishability is nice because of its relative 
simplicity in expression. However, this measure is not 
completely satisfactory in that it has no direct statistical- 
inferential or information-theoretic meaning. 

Another measure of how distinct po{b) and pi{b) are 
is the actual Shannon information obtainable about the 
identity of the distribution. For complete generality, let 
us suppose for the moment that Eve is expecting the two 
different quantum states po and pi with possibly distinct 
prior probabilities ttq and tti !^ Then the amount of Shan- 
non (mutual) information Eve stands to gain from the 
measurement {E^} is 



/(po,Pi) = H{p) - TToHipo) - ^iiJ(pi) , (15) 



where 



Hiq) lib) log q{b) 



(16) 



is the Shannon entropy of a probability distribution q{b), 
and, in particular 



p{b) = nopaib) + nipi{b) 



(17) 



*Up until this point, we have assumed that Eve has no prior 
expectation for a bias concerning which state of the two would be 
prepared. That is to say, we have been working under the assump- 
tion that TTQ = vri = 1/2. This remains assumed even now, despite 
the further generality of our formulation; the introduction of an 
asymmetry is solely for the purpose of comparison to other forms 
in the literature. 



is the overall prior probability for an outcome b. This 
measure is particularly appropriate for gauging Eve's 
measurement performance if her purpose is to identify or 
make an inference about a long string of quantum states 
prepared according to the distribution {7ro,7ri}. 

Finally, we consider the situation in which Eve bases her 
performance on the success of a guess about the identity 
of one single instance of Alice's prepared state. Suppose 
Eve obtains outcome b in her measurement. She can use 
this knowledge to update her probabilities or expectations 
about which state Alice really prepared. This is done 
formally via a use of Bayes' rule d). Namely, after the 
measurement, her posterior expectation for the value of s 
is given by 

TTs Ps{b) 



p{s\b) 



p{b) 



(18) 



Clearly the best strategy for Eve is to guess the value of s 
such that p{s\b) is largest. Her probability of making an 
error will then be the minimum of p(0|6) and p(l|fo). Av- 
eraging this over all possible outcomes gives the expected 
probability of error upon making the measurement {Eh}: 



Pe{po,Pi) = ^min |7roPo(fe), t^iPi ib)] 



(19) 



The three measures, Eqs. (|l^), (|l5|), and (|l9|), each 
have the heuristic properties required of one ingredient in 
a tradeoff principle: as we vary across measurements, the 
smaller the overlap, the larger the Shannon mutual infor- 
mation, or the smaller the error probability of a guess, 
then, heuristically, the larger the "information" Eve has 
available about Alice's preparation. This is not to say, 
however, that the measurement optimal for any one of 
these distinguishability measures will be the same as that 
for any other; this will generally not be the case p^ . 

For instance, when po and pi are both invertible, the 
measurement optimal for minimizing the statistical over- 
lap 0, Eq. (|l|), is the von Neumann measurement cor- 
responding to the rather complicated Hermitian operator^ 



Pi 



Pi' Po PV Pi 



(20) 



The measurement optimal for maximizing the mutual 
information, Eq. (p^, generally has no analytic expres- 
sion, as can already be seen at the level of density opera- 
tors on two dimensional Hilbert spaces . On top of 
that, more generally, the number of outcomes in an opti- 
mal measurement is not even known; the strongest result 
yet proven only bounds that number to be less than the 
square of the Hilbert space dimension [|2| . 

In contrast, the measurement for optimizing the prob- 
ability of error |2^, Eq. ([l^), is again a von Neumann 

^The square root of a nonnegative definite operator signifies an 
operator diagonal in the same basis as the said operator but whose 
eigenvalues are the positive square roots of the previous. 
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measurement. In fact, this time the optimal measurement 
corresponds to a fairly simple Hermitian operator: 



(21) 



Generally there are no values of ttq and tti such that all 
three "optimal" measurements coincide. 

To reflect the fact that we are interested only in Eve's 
ultimate performance as an ingredient for an information- 
disturbance principle, we focus hereafter on the optimized 
versions of the three distinguishability measures. This 
forces all measurement dependence on Eve's part out of 
the picture. 

The minimal statistical overlap after varying over all 
measurements turns out to be |T7|, p3 : 



B{pl,pl) =trVpf 



Pi pV 



(22) 



This is quantity is related to the Uhlmann fidelity function 
F(pg,pf) for quantum states |||, through| 



(23) 



The fidelity has several interesting properties despite 
its somewhat loose connection to statistical tests. For in- 
stance, though it is necessarily bounded between and 
1, it equals unity if and only if the two quantum states 
in its arguments are identical. Also, despite first appear- 
ances, it is symmetric in its arguments. In the case that 
P\ = is a pure state, Eq. ( p2|) reduces to 



npl.pi) = {r,\pi\ri) 



(24) 



The optimal mutual information, or accessible informa- 
tion^ IlpQ^pf), again, generally has no analytic expres- 
sion. However, there is a growing literature of succes- 
sively better bounds on this quantity — see references in 
Ref. [^. One particularly interesting bound (because of 
its simplicity in form) due to Holevo l2^, |l^ is 



I{pl pl) < Sin ~ ^^S{pl) - TT.Sipf) , (25) 



where 



and 



S{a) = -tr((7log(T) 



(26) 



(27) 



is the von Neumann entropy of a density operator a. It 
should be pointed out, however, that this bound is often 
not very tight; the satisfaction of equality in Eq. ( p5| ) 
comes about if and only if /5q and pf commute. 



''A distinction is drawn between fidelity and minimal statistical 
overlap because, for different applications, one form can be more 
convenient than the other. As far as interpretation is concerned, 
the two quantities appear to be on an equal footing. 



Finally, as might have been expected, the optimal error 
probability turns out to be the simplest distinguishability 
measure of the lot: 



Pe{plpf)^l-lt^ 



(28) 



where | • | signifies an operator diagonal in the same basis 
as its argument, but with eigenvalues that are the absolute 
values of those of the argument. (Because this particular 
distinguishability measure is so important for the consid- 
erations here, we give a new derivation of Eq. (28) in the 
Appendix.) 

Of the three measures of Eve's performance discussed 
here, perhaps the accessible information is the most rele- 
vant for eavesdropping in quantum key distribution. How- 
ever, even this has its shortfalls. Presently it is not known 
whether there is any single numeric summary of Eve's 
posterior probabilities for the identity of ps — such as the 
mutual information — that can be used for privacy ampli- 
fication 1^] against all possible eavesdropping strategies 

ill- 

2.4 Disturbance Measures 

In order to gauge the amount of disturbance Eve inflicts 
upon Alice's system as she gains information about it, 
we must flnd a way compare the state of Alice's system 
before it enters the black box to the state of the system 
after it exits. That is to say, we must find a way to com- 
pare both pq to Pq and pi to /5*. Of course, no single 
simple numerical measure or "distance" will be adequate 
to all tasks: the quantum states are operators on Ti.A- In 
matrix representation, each state will have up to N'^ — 1 
real parameters (corresponding to the real and imaginary 
parts of its entries). Just naively, one would expect that 
it should take at least that many numbers to capture all 
aspects of Eve's disturbance. 

Nevertheless, one can still go a long way toward quan- 
tifying disturbance with simple numerical measures. In 
particular, to get started, one need only notice that there 
are at least as many disturbance measures as there are 
distinguishability measures. Each of these can be used as 
a notion of "distance" between the initial and final states. 
Moreover, these are especially nice in that they have direct 
experimental significance, each being intrinsically tied to 
some statistical or information theoretic test. 

As a simple example of how a distinguishability mea- 
sure can be used to make a disturbance measure, consider 
the following quantity: 

D{U) = l-^F{po,p^)~^F{p,,pt) . (29) 

This is just one minus the average fidelity between input 
and output. Notice that D{U) has a functional depen- 
dence on the initial states po and pi, the dimensionality 
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of Eve's probe's Hilbert space He, the probe's initial state 
(7, and the particular unitary interaction U that Eve uses 
for her eavesdropping. For brevity and convenience, we 
have made only the functional dependence on U explicit 
in the labeling of this disturbance measure. 

Equation (29) fulfills — at the very least — the minimal 
requirement of an intuitive disturbance measure: it has 
the virtue that it vanishes if and only if pg = po and 
Pi = pi. In addition to that, however, it equals unity if 
and only if the outputs are orthogonal to the inputs — that 
is, that Eve's eavesdropping has probability one of being 
caught. Finally, because it can be interpreted as related 
to the statistical overlap of two probability distributions, 
we can be sure that it is monotonic with our intuition at 
all points between. 

Eq. ( ^ is perfectly reasonable as far our purposes are 
concerned. Nevertheless, one should not lose sight of the 
fact that D(U) is quite arbitrary as a disturbance mea- 
sure. This remains true even if one insists that a distur- 
bance measure be built from the fidelity function alone 
and not any other distinguishability measure. For in- 
stance, one can still ask, "Why take an average of the 
two fidelities? Why not a geometrical mean? Why not 
relate the disturbance to the minimum of the two fideli- 
ties?" The questions can go on and on. The only means 
for relieving the arbitrariness in choosing a disturbance 
measure is to have a specific physical/experimental appli- 
cation in mind. This is just as it was for the discussion of 
Eve's possible information-gain measures. 

Let us give one more example along these lines to help 
firm the idea that the number of variations on the theme 
is quite large. Suppose Alice expects the eavesdropper to 
be active at random and only 50% of the time. When- 
ever active. Eve will use the same strategy Eq. (^), which 
Alice knows in advance. A natural notion of disturbance 
for this particular scenario is the (best possible) proba- 
bility that Alice can catch Eve out when she is active. 
When the probability of catching Eve is large, then the 
disturbance can be assumed large; when the probability 
of catching Eve is no better than chance, then the dis- 
turbance is small. Thus, referring to Eq. (28), the distur- 
bance of input state s is quantified by 



1 I 

Ps = - + -tr 

2 4 



(30) 



On average then, the disturbance viewed in this way is 



Dg{U) 



1 



-tr 



Pa - Po 



-tr 



Pi - Pi 



(31) 



The same sort of game, of course, can also be played with 
the maximal amount of information that Alice can gain 



about Eve's activity, giving rise to still another distur- 
bance measure. 

Finally we note that, above and beyond these examples, 
there are still other ways of using the distinguishability 
measures of the last subsection for the purpose of gaug- 
ing Eve's disturbance. For instance, they may be used 
not only to compare the input and output states of Al- 
ice's system but also for checking the extent to which Eve 
has broken the coherence of that system with yet other 
systems. This is an idea due to Schumacher [Q. It is 
especially relevant to the model considered in this paper 
because Alice recovers her quantum system after Eve has 
interacted with it; Alice's system is not passed on to a 
third person, such as Bob, as is the case in quantum key 
distribution scenarios. Therefore Alice is in the position 
to check whether coherences have indeed been broken. 
By the same token, this measure may be less relevant to 
quantum cryptography. 

Let us spell out Schumacher's idea in some detail. Sup- 
pose Alice prepares her two states po and pi by preparing 
a composite system in the pure states \4>o^) and on 
the tensor product Hilbert space Ha'^'Hb- The intention 
is to give to Eve only that part of the system described 
on the Hilbert space Ha- Therefore, for s = 0, 1, the pure 
states must satisfy 



tr, 



(32) 



If the upshot of Eve's interaction with Ha is given by 
Eq. (^), then the overall state of the composite system 
after the single component emerges from the black box 
will be 



E 



(i,®/B)|Vf)(V'ri(^®4)^ 



(33) 



where /b is the identity operator an. Hb- The main point 
is that we need not be content comparing only ps to /5* 
because in this scenario we also have the option of com- 
paring |'0f'^) to /5*^. 

One might think that such a procedure would open a 
can of worms with respect to the original statement of 
our problem. For instance, by introducing the purifi- 
cation \ips^) of Ps, one might think we are introducing 
much more freedom in the formulation of the problem 
than there was previously. There are an infinite num- 
ber of purifications of the given density operators with 
all manner of relations between themselves. One would 
think that surely, whatever disturbance measure we build 
with these purifications, it will inherit that extraneous 
freedom. 

Surprisingly, that turns out not to be the case — at least 
for some measures of distinguishability. To take as an 
example, one can speak of the fidelity between input and 
output in this scenario, a quantity Schumacher calls the 
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entanglement fidelity: 



Fs = F 



(34) 



This quantity turns out to be completely independent of 
the particular purification chosen for ps \ ^T\ - Hence it 
can be expressed purely in terms of ps and the particular 
operation Eve subjected ps- In Ref. p^, it is shown that 



(35) 



As might be expected, the entanglement fidelity can be 
a more exacting measure of change between input and 
output. For instance, it can be proven that |27, || 



(36) 



Thus, if Eq. (^9|) is considered an adequate disturbance 
measure for a particular application of our model, then so 
too should the more stringent measure 



Ds{U) 



1 



1 



-Fo 



1 



tr(/5ol£) 



tr{piAe 



(37) 



This is just a small sampling of the numerous things 
that can be imagined for gauging disturbance in a quan- 
tifiable way. Nevertheless, the options are already great 
enough to start thinking seriously of several ways of view- 
ing an information-disturbance tradeoff principle. 

2.5 Tradeoff 

Finally, we are in a position of taking our two building 
blocks, information measures and disturbance measures, 
and combining them to arrive at a formal tradeoff princi- 
ple. The first thing to recall is that once the two quantum 
states po and pi are fixed, the only free variables in any 
of the measures are the dimensionality of He, the probe's 
initial state a, and the unitary interaction U. To expedite 
our discussion, let us consider a generic information mea- 
sure I{U) and a generic disturbance measure 'D{U). The 
discussion to follow remains true for any two such mea- 
sures. It should be noted that only the [/-dependence of 
X and V has been made explicit. (The reason for this will 
be made clear below.) 

There are at least two straightforward ways to combine 
X(C/) and 'D{U) into various "tradeoff relations." The 
simplest idea is rather analogous to the construction of 
the Heisenberg uncertainty relations in that it is based 
on the idea that there must be some standard "figure of 
merit" for comparing information and disturbance. In the 



Heisenberg relations, the figure of merit for the "tradeoff" 
of Ace and Ap is a multiplicative one: 



AxAp > - 



(38) 



In our case, we may well imagine a standard or convenient 
function : H x IR ^ R with which to compare the two 
quantities of our concern. If it is an interesting function, 
then it will be bounded in at least one direction — say, 
from below — and we will be at liberty to define 



^{PoiPi) = min T 



{l{U),V{U) 



(39) 



where the minimum is taken over all the free variables of 
X and T). Notice that what remains is a function purely 
of the two input states po and pi. Eq. ( |3S| ) defines an 
information-disturbance tradeoff relation for an arbitrary 
probe, probe initial state, and interaction on Eve's part 

by 

t{x{U),V{U))>B{po,Pi) ■ (40) 

The right hand side of Eq. ( ^ plays the role of the h/2 
in the Heisenberg relations. As already noted, the lower 
bound in this new principle depends on the two quantum 
states under consideration. This is completely reasonable: 
one expects a necessary information-disturbance tradeoff 
only when the two states being compared cannot be in- 
terpreted as "classical" states. For instance, when po and 
pi_ are pure and orthogonal, all the information about the 
state's identity can be recovered without incurring any 
disturbance whatsoever. 

The second way to think about a tradeoff relation is to 
ask, "For a fixed disturbance, what is the maximal infor- 
mation that Eve can recover about the state's identity?" 
This defines a constrained-variation problem: for fixed 



V[U) = d , 

where d is some constant, what is 

Xopt = max X{U) 



(41) 



(42) 



The optimization here again is taken over all the free vari- 
ables of X, namely over all probes, over all initial states for 
each probe, and over all unitary interactions. As opposed 
to the last method, which characterizes the nonclassicality 
of Po and pi by a single number, this method characterizes 
the same via a complete curve, say. 



C 



|Xopt(rf) 



< d < 1 



}■ 



(43) 



Equations (|o|) and ( [f3| ) encapsulate the essence of what 
this paper is about Using any of the measures of the 

^Our emphasis of these options for expressing the information- 
disturbance principle should not be taken to preclude the possibility 
that weaker bounds along the same lines might also be useful. For 
instance, an unachievable bound in Eq. ( |4o| ) may also be of interest 
for various purposes. For an application along these lines related to 
quantum cryptography, see Ref. |30|. 
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preceding subsections, or using any measures left yet un- 
considered, these equations define quite rigorously what 
is meant by the phrase "information gain and quantum 
state disturbance go hand in hand in quantum theory." 

In Section 4, we shall carry out the information- 
disturbance principle program in some detail for two pure 
quantum states. This gives something of a flavor for how 
the program goes in the general case, but it also hints at 
the calculational difficulties that crop up even in the sim- 
plest of cases. Before pursuing this, however, we explore 
in the next section the significance of this principle within 
the historical context. 

3 Historical Context 

In this Section, we shall briefly explore the connection be- 
tween the ideas developed here and some common preju- 
dices concerning measurements and disturbance. 

It is often said that the Heisenberg uncertainty relations 
are the ultimate reason that Eve's measurements disturb 
Alice's system in quantum key distribution.^ To the ex- 
tent that this statement can be given a precise meaning, 
it is rather beside the point in this context. The Heisen- 
berg relations concern our conceptual and experimental 
inability to simultaneously "get hold" of two classical ob- 
servables, such as a particle's position x and momentum p. 
Thus they concern our inability to ascribe classical states 
of motion to quantum mechanical systems. This remains 
true of any of the standard meanings for the phrase "un- 
certainty relation" — that is, whether one is speaking of a 
semiclassical argument like Heisenberg's original one , 
the well-known textbook version of the relation due to 
Robertson or instead rigorous bounds on the simul- 
taneous measurability of conjugate variables Q. 

Moreover, the Robertson version of the relation has 
nothing to say about the idea that observing one clas- 
sical variable causes a "disturbance" to the other. In par- 
ticular, upon following its derivation carefully, one finds 
nothing remotely resembling the picture of the Heisenberg 
argument p^ . What is found instead is that, when many 
copies of a system are prepared in the same quantum 
state ip{x), if one makes enough position measurements 
on the copies to get an estimate of Aa;, and similarly 
makes enough momentum measurements on different (!) 
copies to get an estimate of Ap, then one can be assured 
that the product of those numbers will be no smaller than 
h/2. No reciprocal "disturbance" of any kind is involved 
here, since x and p are measured on different systems. 

The source of the misunderstanding is perhaps typified 
by statements such as the following from Wolfgang Pauli, 

**One notable exception is Rof. , which asserts, "... quan- 
tum cryptography . . . reUes on the impossibiUty of ascribing defi- 
nite values to noncommuting variables in order to assure secrecy of 
communication." 



collecting a set of thoughts now ingrained in the folklore 
of the theory [|| p. 132]: 

The indivisibility of elementary quantum pro- 
cesses (finiteness of the quantum of action) finds 
expression in an indeterminacy of the interac- 
tion between instrument of observation (subject) 
and the system observed (object), which can- 
not be got rid of by determinable corrections. It 
is therefore only the experimental arrangement 
that defines the physical state of the system, 
whose characterization thus essentially involves 
some knowledge about the system. For every 
act of observation is an interference, of undeter- 
minable extent, with the instruments of observa- 
tion as well as with the system observed, and in- 
terrupts the causal connection between the phe- 
nomena preceding and succeeding it. The gain 
of knowledge by means of an observation has as 
a necessary and natural consequence the loss of 
some other knowledge. The observer has how- 
ever the free choice, corresponding to two mutu- 
ally exclusive experimental arrangements, of de- 
termining what particular knowledge is gained 
and what other knowledge is lost (complemen- 
tary pairs of opposites). Therefore every irre- 
vocable interference by an observation with the 
sources of information about a system alters its 
state, and creates a new phenomenon in Bohr's 
sense. 

These sorts of ideas, folklore or not, have very little to 
do with the limits of what can happen to quantum states 
when information is gathered about their identity. The 
theme of the approach suggested by quantum cryptogra- 
phy differs from that used in formulating the Heisenberg 
relations in that it makes no reference to conjugate or 
complementary variables. The only elements entering the 
considerations are related to the quantum states them- 
selves. Because of this, one is forced to contemplate a 
notion of state disturbance that is purely quantum me- 
chanical in character, making no reference to the semi- 
classical considerations that drove early conceptual work 
on the theory. 

Indeed, the main contribution of quantum cryptog- 
raphy to fundamental physical understanding has been 
the lesson that that we must focus on multiple (non- 
orthogonal) quantum states for the construction of an 
information-disturbance principle.^ Once the focus is 
shifted from conceptually gauging disturbance in terms of 
classical variables to gauging it in terms of the the quan- 
tum states themselves, there is no necessary disturbance 
whatsoever connected to the process of measurement — if 
one is talking about a single quantum state [^ . For in- 

®The first appearance of this idea seems to be in the work of 
Stephen Wiesner circa 1970. It was written up in a manuscript 
titled "Conjugate Coding" submitted to IEEE Transactions on In- 
formation Theory, but remained unpublished until much later 
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stance, suppose Eve encounters only a single pure state 
\'ip) in our scenario — rather than one of a set of two 
nonorthogonal states — and she makes a measurement di- 
rectly on Alice's system corresponding to a set of orthog- 
onal projectors lib = |^)(^|- Then there is no physical 
principle that can prevent her from using a measurement 
interaction that returns Alice's quantum system back to 
the state ji/') at its completion. This is a simple con- 
sequence of the fact that Eve knows the identity of the 
incoming state. Her general inability to predict her mea- 
surement outcome cannot erase this — it does not matter 
how random the outcome of the measurement turns out 
to be. Nor does it matter that a second measurement 
of the same observable may reveal a completely different 
outcome than the first. 

The idea of a necessary disturbance to quantum states 
upon measurement only becomes effective when that mea- 
surement's "random" outcome reveals some statistical in- 
formation about the identity of the unknown quantum 
state. Also crucial here is that the set of possible states, 
even though known to Eve, have at least some elements 
nonorthogonal to the others. This makes a classical repre- 
sentation of the states in terms of mutually existent objec- 
tive properties impossible. This is the legacy of quantum 
cryptography. 

What does it mean to say that the states are disturbed 
in and of themselves without reference to classical vari- 
ables? It means quite literally that Alice faces a loss 
of predictability about the outcomes of further measure- 
ments on her system whenever an information gathering 
eavesdropper has intervened. Take as an example the case 
where po and pi are nonorthogonal pure states. Then, 
for each of these, there exists one nontrivial observable 
for which Alice can predict the outcome with complete 
certainty — namely the projectors parallel to po and pi. 
That is to say, she can ask the system, "Are you in the 
state I prepared you in," and it will answer yes with cer- 
tainty. However, after her system passes into the black 
box occupied by Eve and returns, she will no longer be 
able to predict completely the outcomes of both these 
measurements. This is the real content of these ideas: 
the disturbance is to Alice's description of her system and 
what she can predict of it. 



4 Pure States 

We shall devote ourselves in this Section to working out, 
for two nonorthogonal pure states, one of the many trade- 
off principles discussed in Section 2. The particular one 
considered is motivated by its overall simplicity, not by its 
operational significance for quantum cryptography. The 
overriding concern is that — in this way — we will be able 
to carry out the majority of the steps analytically. Con- 
sequently, in this exercise, we will be less reliant on vari- 



ous numerically motivated conjectures than was the case 
for previous endeavors It is hoped that this pro- 

cedure will lead to insight into the general structure of 
more practically- motivated tradeoff principles, such as 
that considered in Ref. [|9|.[3 

Let us jump into the example. The two quantum states 
that Alice prepares are po = |0)(0| and pi = |1)(1| where 



|0> 



ID 



cosajflo) -I- sinajai) 



sma |ao) 



cosa \ai) 



(44) 
(45) 



are vectors on a two-dimensional Hilbert space Ti.A- Here 
\ao) and |ai) form an orthonormal basis on Ha- Alge- 
braically, the distinction between these states is parame- 
terized by the single number 



S = (Oil) = sin 2a 



(46) 



As already discussed in great detail. Eve — in an at- 
tempt to gather information about the identity of the 
state Alice prepared — will interact Alice's system with a 
probe described by the states on a Hilbert space He- This 
will lead to Alice being left finally in possession of a sys- 
tem described by a density operator p^. Similarly Eve 
will be left with her probe being described by some den- 
sity operator . In each case, the value of s depends on 
Alice's particular preparation. 

The tradeoff principle we shall consider in this Section is 
based on the information-gain and disturbance measures 
of Eqs. (|2^) and (pOt), which here reduce to 



Pe{U) = 



1 



1 



■tr 



(47) 



and 



DiU) 



1 



1 



(48) 



1 

2 2* 

respectively. That is to say, the "information" measure is 
taken to be the best possible probability of error that Eve 
can encounter when trying to guess the identity of Alice's 
preparation; the disturbance measure is taken to be the 
average probability that Alice will detect a discrepancy if 
she performs a test corresponding to the actual state she 
sent into the black box. 

The particular way we shall combine the two ingre- 
dients, Eqs. ( p7| ) and (^), is in finding a curve as in 
Eq. (p3|). That is to say, for fixed 



and 



D{U) = d 



P°P*(d) = minPe(C/) 
u 



(49) 



(50) 



^"The tradeoff principle there is based on the same disturbance 
measure as considered here. However the information measure is 
the actual Shannon information accessible to Eve. Under certain 
circumstances and certain assumptions, these two quantities are suf- 
ficient for definiiig a privacy amplification procedure for quantum 
key distribution [b|| in the context of the BB84 protocal M . 
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where the minimization is performed subject to the con- 
straint, we seek to find the curve 



c = { p:^\d) 



0< d< dt 



(51) 



The constant do denotes the minimal disturbance that 
need be incurred in the process of finding the maximal 
allowed information. Thus we are assuming that the dis- 
turbance is never so large as to be an unnecessary distur- 
bance.^ 

This plan requires that we be able to perform the con- 
strained variation necessary for it. We tackle this problem 
in several steps. The first is in finding the simplest gen- 
eral description of the probe and its unitary interaction 
with Alice's system. The second is in calculating all the 
relevant quantities of the tradeoff relation for a fixed in- 
teraction on Eve's part. The third is making a two-state 
probe plausible by analyzing a set of variational equations. 
Finally the curve is optimized based on the assumption 
of a two state probe. 

4.1 The Probe and Interaction 

We set the wheels turning by noticing that there is no 
utility in Eve allowing her probe to start off in a mixed 
state. This is because any mixed state for Eve's probe 
can always be thought of as arising from a partial trace 
over the degrees of freedom of a larger probe prepared in 
a pure state j2^. Since the dimensionality of the probe's 
Hilbert space TYb is a free variable anyway, this choice 
will cause no loss in generality. 

But then, however, there is no use in declaring the ini- 
tial state of the probe in our variations: any pure state can 
be transformed unitarily into any other pure state. This 
forms the reason why we have made U the only explicit 
argument of the various information and disturbance mea- 
sures: it encodes both the probe's dimensionality and the 
particular interaction it undertakes. 

Let us now focus on saying something about the di- 
mensionality of Ti.E- The interaction U takes its formal 
description as a unitary operator on Ha ^Ti-E- Suppos- 
ing, as just discussed, the probe starts off in some stan- 
dard pure state jV'), we can describe the outcome of this 
interaction as follows: 



E 

n=0 



\At)\Ei 



(52) 



s = 0, 1, and where I'l'*'^) is written in Schmidt polar form 
for orthonormal bases |^^) and \E!^) (parameterized 
by Alice's preparation s) on T-La and T-Le respectively. The 
bases and the constants will of course depend on the 
particular unitary operation U used. The important thing 



^^This assumption is not necessary; it is made only for the purpose 
of relaxing the need to make repetitive conditional statements later. 



to note, however, is that the number of nonzero A^j is 
determined by the dimensionality of TLa- 

Writing the post-interaction states in Schmidt polar 
form is particularly convenient because then one easily 
sees that the state of the system finally left in Eve's pos- 
session is of the form 



= tr, 



ri 



\l\E^,){E^,\ + \l\Ei){Ei\ 



(53) 



Similarly the states passed back to Alice are of the form 



= trp 



= \^M{A^,\ + \{\A{){A{\ 



(54) 



Eq. (^3|) tells us, rather interestingly, that we never 
need consider probes for Eve with Hilbert space dimension 
greater than four |l^. This follows because, at most, all 
four of the can be linearly independent vectors. This 
means that the relevant states accessible to Eve can never 
act on more than the span of these four vectors. The 
states /5q and p\ are thus always confined to actions on 
(effectively) four-dimensional Hilbert spaces at the outset. 

It was found numerically — but not proven — for the 
tradeoff relation considered in Ref. ||l^ that, in the end, 
a two-state probe always sufficed for defining the optimal 
tradeoff curve. In certain ways, this was rather surpris- 
ing: Eve's probe never need take advantage of all the 
Hilbert space allotted it. Therefore it would be very nice 
to demonstrate the same effect rigorously for the present 
tradeoff relation. Unfortunately, this goal has yet to be 
found attainable: the algebra becomes quite unwieldy. 
The best that has been demonstrated (assuming the var- 
ious mild assumptions to be made below) is that a two- 
state probe makes the tradeoff stationary. However, this 
does not demonstrate that a two-state probe is globally 
optimal; it only demonstrates that a two-state probe is lo- 
cally the best, the worst, or an inflection point. There are 
indeed other local optima, though — based on numerical 
simulations — none appear to be the global optimum. 

In what follows, we shall sidestep the issue of trying to 
show that, starting with a four- dimensional probe, a two- 
dimensional one suffices to make the variation stationary. 
There appears to be nothing to be gained from this ex- 
ercise other than mathematical heartache. Instead, here, 
we shall start off within the restricted scenario of allowing 
He to be up to three dimensional. This allows for a much 
easier path to the essential physics that a two-state probe 
suffices for the construction of the optimal (stationary, 
to be more precise) Pe-D tradeoff curve. It also cleans 
up the mathematics in this paper considerably and helps 
make the exposition tractable. It must be emphasized, 
however, that by making this restriction, we cut off the 
possibility of proving that the curve we shall ultimately 
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obtain is actually optimal — though, based on numerical 
work, we certainly believe it is. Full rigor or a better 
methodology for tackling this problem must remain the 
subject of future work. 

All that said, let us take Ti^; to be a three-dimensional 
Hilbert space and let us equip it with an orthonormal ba- 
sis \ep), (3 = x,y, z. (Ultimately we will choose this basis 
to be as convenient as possible.) This gives a natural basis 
for the Hilbert space TCa'^'He, namely the tensor product 
basis |am)|e/3), m = 0, 1 and f3 = x,y,z. The set of all 
possible unitary operators on this six dimensional Hilbert 
space is quite large: without some further symmetry ar- 
guments for reducing its size, our variational problem will 
remain quite intractable. To this end, let us start building 
some notation. 

Let us write the action of each unitary operator U in 
our variational in the following way: 



where 



U\am)\-ip) = \an)\Rmn) 



n=0 



where 



(55) 



(56) 



Since Eve's probe starts off in the standard state we 
need not be concerned with the action of U on the remain- 
der of the Hilbert space. Note that unitarity requires that 



n,/3 



(57) 



At least one thing should be clear at this point. If Alice 
were to relabel her orthonormal basis jom) by interchang- 
ing and 1, this would only lead to a relabeling of her 
two input states. The algebraic relation between the in- 
put states, Eq. (^), remains invariant. Thus one should 
expect that Eve will never need to break that symmetry in 
her apparatus to ferret out the best tradeoff. Therefore, 
we may fairly safely assume that under the interchange 
0^1, the probe's states (relative to the basis states of 
Alice's system) keep the same algebraic relations among 
themselves. That is to say, we may assume that the opera- 
tor U is always such that all inner products {Rm'n'\Rmn) 
remain invariant under an interchange of 1 in the 
indices. 

This already places severe restrictions on the set of uni- 
tary operators that we need consider for the variation. 
However, we can still go a few steps further in restriction. 
For this let us write the input states in Eqs. ( ^4| ) and ( ^ ) 

as 



E 



Then, we can rewrite Eq. (|52D as 



(58) 



(59) 



(60) 



m=0 



In this notation, the final states accessible to Eve for in- 
formation gathering measurements are 



n=0 



(61) 



Equation (|61|) is of particular interest because it tells us 
that we can freely adjust the phase of all the vectors 
with no effect whatsoever on the states received by Eve. 
This translates into the freedom to set the phase of the 
\Rmn) as we wish, as long as we do it to |i?oo) and |iiio) 
in unison and as long as we do it to |i?oi) and in 
unison. (This follows from the requirement that Eq. ( |60| ) 
hold.) 

To see where this isgoing, let us write the four equa- 
tions implicit in Eq. (^6|) as: 

|i?oo) = Xi|e,)+X2|e^)+X3|e,) (62) 

|i?oi) = Xi\e^) + X5\ey) + X(i\e,) (63) 

|i?io) = X^\e,) + X^\ey) + X^\e,) (64) 

|i?ii) = Xw\e^) + Xii\ey) + Xi2\e,) . (65) 

In terms of these new variables, the unitarity relation 
Eq. ( p7| ) becomes, 



^ XlXk = ^ XlXk = 1 



fc=l 



/c=7 



and 



XlXk+e - 



(66) 



(67) 



k=l 



What we would like to do is use the freedom in the 
arbitrary basis \ep), the symmetry requirements, and the 
extra phase freedom just mentioned to make the Xk , k = 
1, . . . , 12 as simple looking as possible. To do this, we 
first choose the phase of so that X12 is real. Next, 

we recognize the fact that |i?oi) and |i?io) must be of the 
same length. This follows because we require 



(i?oi|^oi) — {Rw\Ri 



(68) 



n=0 



Therefore, we may choose the basis states jc/j) so that: 
X4 = Xg, X^j = Xj, X4 and X5 are both real, and X^ — 
ATg = 0. Finally we use the phase freedom in |i?oo) and 
\ez) to make both X2 and X3 real. In particular, we take 
the opportunity to make X3 and X12 of the same sign. 
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Thus the situation is, at present, the following 
\Roo) - X,e'''\e^)+X2\ey)+X3\e,) (69) 

\Roi) = X^\e,) + X^ley) (70) 

|i?io> = X,\e^) + Xi\ey) (71) 

= Xwe'^'^'le,) + Xne''''\ey) + XM ■ (72) 

In these equations and hereafter we treat all the Xk as 
real, making all phases explicit in the factors 6*^*= . 

Can we go the remainder of the way and justify setting 
giSi^ giSio^ g^jjj giSii g^j^ |-jg j,gg^^ numbers? Actually, the 

answer is yes, though it should have been quite plausible 
in the first place: since the input states, Eqs. (^J) and 
(^5|), involve only real coefhcients, there is no reason to 
expect complex numbers to be necessary for describing 
Eve's probe. Let us prove this now. 
The symmetry requirements 

(i?io|-Roo) = (-Roil^ii) (73) 

(i?oo|i?ii) = (i?ii|i?oo) (74) 

respectively, give 

X^Xie'''' + X4X2 = XiXioe'""' + X^Xne''^^^ , (75) 

and that the quantity 

XiXioe'^^"'"'^'^ + XzXiie^^ii (76) 

is real. On the other hand, Eq. ( |67|) requires 

XiXse^^i + X2X4 + XiXioe'^^" + X^Xne'^^' = . (77) 

Equations and { fn\ } taken together imply that we 
must have 

XiX^e'^' + - . (78) 

Thus e*^i = ±1. By the same token, we must also have 
gi(eii-eio) _ _|_]^_ Finally, these two facts along with the 
reality of the quantity in Eq. (^6|) gives that both e*^" 
and e**^° are real. That is to say, we have just proven 
that by suitable choice of basis and phase, all the Xk may 
be assumed real without loss of generality. 

The four \Rrnn) can be visualized easily as vectors in 
a three-dimensional real vector space. In fact, by mak- 
ing a sketch, one immediately sees that the symmetry 
requirements taken together uniquely fix the components 
of the vectors up to a freedom of relative sign between X^ 
and Xi2. However, this particular freedom was already 
taken away by fiat above. Therefore, we set X3 = X12. 
Absorbing all the remaining phase freedom back into the 
variables, we have in the final accounting: 

|i?oo) - Xi\e,) + X2\ey) + X3\e,) (79) 

|i?oi) = Xi\e^) + X^ley) (80) 

|i?io) = X^le^) + Xi\ey) (81) 

|i?ii> = X2\e,) + Xi\ey) + X:,\e,) . (82) 



The unitarity relations, Eqs. (|6^) and (^^, after all 
these simplifying assumptions, become 

X'i + Xl + X| + Xl + X| = 1 , (83) 

and 

ATiXs + - . (84) 

This means that in our variational problem, we need only 
search over three free parameters: this is a substantial 
savings over approaching the problem blindly! We may 
parameterize the remaining X-^ in the following way: 

X\ = cos A cos d cos (/) 

X2 = cos A cos Q sin 

X-i = sin A (85) 

X4 = cos A sin Q cos ^ 

X5 = — cos A sin sin </) . 

How is a two-state probe — as opposed to a three-state 
probe — expressed in these terms? Notice that if, for what- 
ever reason, sin A = 0, then the four |i?mn) will all be 
confined to the same two-dimensional subspace of I-Le- 
Thus, if at the end of the calculation we find that A must 
be an integer multiple of tt, we will have demonstrated 
that Eve's probe could have been taken to be a two state 
system in the first place. 

4.2 After the Interaction 

Let us now fix a particular unitary operator V given by 
Eq. (|85| ) and work out all the operators and quantities 
relevant to both Alice and Eve. 

We start by finding the density operators p^, s — 0, 1, 
accessible to Eve.^^ Given all the formalism developed, 
it is really just a question of turning the algebraic crank. 
After a lot of careful algebra, one finds: 

{pVixx = icos^A(^H-cos2Q:cos20^ (86) 

(Po)ki; — i cos'^A^(cos a — sina)^ sin2((^ — 6*) 

+ (cosa + sina)^sin2(0 + 6')^ (87) 

{.(^xz — ^sin2A^sin^asin0cos6' 
-I- cos^acos0cos0 

+ cos a sin a (cos — sin (/>) sin (88) 

^■^We list all the components rather than cut to the chase of the 
final expression for Pe(J7) to save some work on the part of any- 
one else that may wish to construct other information— disturbance 
tradeoffs. 
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(po: 



yy 



(Po) 



yz 



- cos^A^l — cos 2q! cos 20 
isin2A( 



(89) 



cos a sm cp cos a 
sm" a cos (j) cos 6 
cos a sin a (cos (/> — sin 0) sin ) (90) 



(91) 



Hermiticity determines the remainder of the matrix ele- 
ments for Pq. The matrix elements for pf are given by 
exactly the same expressions except that cos a and sin a 
are interchanged everywhere. 

With all the matrix elements of pg and pf in hand, it is 
a straightforward — though tedious — matter to calculate 
the eigenvalues of the operator 



T' = p--p- 



(92) 



and to arrive finally at an expression for Eve's best- 
possible probability of error. Using Eq. (p^), this is 



Pe{U) = \- ^cos2aVG(C/) , 



where 



G{U) = cos''Acos=^2(?!) + isin22A(l - sm2(j)^ cos^O . 

(94) 

Given the particular strategy of enacting the interaction 
U, Eqs. ( p3| ) and (|9^) completely characterize the ultimate 
"information" available to Eve about Alice's preparation 
(as far as is the concern here). 

Let us now turn our attention to describing Alice's sit- 
uation after her quantum system reemerges from Eve's 
black box. To this end we may write the overall post- 
interaction state as 



/3 



where 



Then 



1 1 



\Qfl) — ^ y ^ CsmUmnp\an} 



m— n— 



Again turning the algebraic crank, one finds: 



(95) 

(96) 
(97) 



it,. 



iPo. 



00 



01 



cos^a^cos^Acos^^ + sin^A 
-I- sin^a cos^ A sin'^6' 



(98) 



cos a sin a I sin A + cos A sin 2(/> cos 26* 



(P^)ii 



-cos A cos 20 sin 26* 
2 ^ 



sin^a^cos^Acos^f? + sin^A 
+ cos^a cos^ A sin'^^ . 



(99) 



(100) 



As before, Hermiticity determines the final matrix ele- 
ment of Pq, and the matrix elements of p^ are given by 
the expressions above except that cos a and sin a are in- 
terchanged everywhere. 

Making use of Eq. (^8|), we finally have an expression 
for the disturbance forced upon Alice's states: 

D{U) = cos^A (sin^ei - i5cos20sin26' 



^52(^1 - sin 20^ cos26'j , 



(101) 

where S is the parameter defined by Eq. (p6|). 

We are now in a position to make the final step toward 
generating the curve of Eq. (pW. 



(93) 4.3 The Tradeoff Curve 



We can see from Eq. (|93| ) that the problem of finding the 
smallest Pe{U) as a function of the constraint Eq. (^ ) 
boils down to finding the largest G{U) as function of the 
same constraint. Let us turn our attention along these 
lines. 

In order for G{U) to be maximal, it must be at least 
stationary with respect to small variations i5A, S(f>, and 69 
in A, 0, and 9, respectively. Thus we must have 



Gx6X + G4,6(l) + Ge69 ^0 



(102) 



where G\ denotes the partial derivative of G{U) with re- 
spect to A, etc. However, not all of these variations can be 
made independently; we must satisfy the constraint that 
D(U) remain constant. Therefore, we must have also: 



DxSX + D^5(f> + DgS9 ^ 



(103) 



Evaluating all the partial derivatives G\, Dx, G^, 



etc., at cosA — 0, we can see that Eqs. (102) and (103) 
are both automatically satisfied. This is no surprise, for 
if cos A = 0, then D — and Pe = 1/2: when there is 
no disturbance whatsoever, there can be no information 
gain — this is the result established in Ref. 

Now suppose cos A 7^ and sin 20 ^ ±1, so that, re- 
gardless of the value of 0, Eve will be able to gain some 
information from her interaction. Under these conditions, 
a little algebra shows that 7^ 0. Thus we may trans- 
form our problem into one of unconstrained variation by 
taking 

5(t) = -^(Gx5\ + Ge59\ . (104) 
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Eliminating this variable from Eq. (103), we have that all 
remaining stationary points must satisfy 



where 



DxGcf, ~ D^G\ — 
DfiGd, — DrhGff = 



(105) 
(106) 



It is easily verified that both of these equations can al- 
ways be satisfied by taking sin A = 0. In particular, when 
sin A — 0, Eq. (105) is satisfied automatically. Equa- 
tion (106) can be satisfied by further adjusting cj) and 9. 



The significance of this result is that a two-state probe 
for Eve is sufRcient to make the information-disturbance 
tradeoff stationary. As already stated, it would be nice 
to go further and show that this set of stationary points 
also leads to a global maximum for G{U), but that is a 
much more difhcult problem. In particular, it is clear that 
there are still other solutions for Eqs. ( |105D and (106) with 
neither cos A = nor sin A = 0. 

Henceforth, we shall rely on this weak result and nu- 
merical work to take it for granted that an optimal in- 
teraction tj will have sin A = 0. With this assumption, 
the remainder of the problem of finding Eq. (pl^) greatly 



simplifies. In particular, the Eq. (94) reduces to 



G{U) = cos220 



(107) 



To simplify things even further, let us temporarily think 
of our problem as one of minimizing D{U) subject to the 
constraint that G{U) be fixed. This problem is equivalent 
to the one we set out to solve, and is of use here because 
we will be able to invert the results of this to get the 
desired form. With this, we have, for fixed 0, that D{U) 
is minimized when MM 



tan 26* 



S cos 20 



(108) 



1 - 52(1- sin 2(/)) 
and this results in a minimal value of D{U) given by 

Anin = \-l[s^ cos2 20 (l - 52 (1 - Sin 2(/.) )' I ^ . 

(109) 

Notice again that, as G ^ 0, I? ^ as it should. Alter- 
natively, the larger the value of G, the more information 
that is gained about Alice's system. When G = 1, so 
that Eve's probability of error is as small as it can be, 
the smallest associated disturbance that can be given the 
states is 

do = l-lVl-S^ + S^ . (110) 



Equation (109) can be inverted to give the solution we 
need. Using Eq. (Es) and a little algebra, we obtain: 



Gopt(d) = - ( V7rf(l - d) - d(l - d) ) , (111) 



(112) 



Taking do as a standard disturbance, we can finally write 
the equation of the long sought after curve: 



P°P'(rf) - ^ - ^ cos2ay^Gopt(d) , (113) 



where 



Gopt(d) 



/ djl-d) d{l - d) 

do(l-do) do{l-do) 



(114) 



and d is restricted to the range [0, do]. This completes the 
exercise of finding the particular information-disturbance 
principle given by Eqs. (^-([Sll) for two pure states. 

There are at least two (disappointing) things to notice 
about Eqs. ( |113| ) and (114). The first is the energy that 
had to be expended in order to work out a tradeoff relation 
for one of — surely — the simplest possible cases. Given the 
hoped-for foundational importance of the principle, this 
is rather curious. In contrast, the general Heisenberg un- 
certainty relation (in the form given by Robertson ]3^) 
comes about via a simple application of the Schwarz in- 
equality. 

The second thing to note about Eqs. ( |113| ) and (114) 
is the relative complexity of the curve. Why is it not 
linear? Or, barring that, why are information and distur- 
bance not simple reciprocals of one another or some other 
such simple relation? Despite the seeming (observation 
based) simplicity of the information and disturbance mea- 
sures chosen for this exercise, it may just be the case that 
there are still better measures to be explored. Perhaps 
the proper measures to use are the ones that will give rise 
to a simple compact expression for the tradeoff principle. 

5 Mixed States 

The deepest understanding of what the information-dis- 
turbance principle has to say about quantum theory as a 
whole will necessarily come from the mixed-state analog of 
these considerations. For only then can a direct compar- 
ison be made to classical probability distributions — the 
object of study in Shannon information theory. The re- 
sults of such a comparison are essential for distilling the 
cut between classical and quantum theories |ll|| . 

Unfortunately, in moving to the mixed state version of 
the information-disturbance principle, the mathematical 
difficulties become even more acute than was the case for 
pure states. This suggests strongly that new techniques 
or a better formulation of the problem are called for. Nev- 
ertheless there is one restricted result about information 
gain versus disturbance for mixed states that brings out 
an interesting mystery. This result is known as the "no- 
broadcasting theorem" 0, nl] . 
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Suppose again that a quantum system, secretly pre- 
pared by Alice in one state from the set A = {po,pi}, is 
dropped into Eve's black box. The only difference be- 
tween the present scenario and our previous considera- 
tions is that now we shall suppose the black box built 
solely for the purpose of broadcasting or replicating the 
quantum state onto two separate quantum systems. That 
is to say, a state identical to the original should appear in 
each system when it is considered without regard to the 
other. We are willing to allow correlation or quantum en- 
tanglement between the systems. Can such a black box be 
built? If so, then that will certainly provide Eve a way to 
gain information about the mixed state without causing 
a detectable disturbance in the system: Eve need simply 
broadcast the state, give Alice one of the systems, and 
make a information-gathering measurement on the other. 

The standard "no-cloning" theorem of Wootters, Zurek, 
and Dieks ^ prohibits broadcasting when the states 
in A are pure and nonorthogonal; for the only way to have 
each of the broadcast systems described separately by a 
pure state \tp) is for their joint state to be \tfj)\tfj); that 
is to say, \^) must be cloned to be broadcast. When the 
states in A are mixed, however, things are not a priori so 
clear. 

A mixed-state no-cloning theorem is not sufhcient to 
demonstrate no-broadcasting, for there are many conceiv- 
able ways to broadcast the mixed states ps without the 
joint state being in the product form ps® ps, the mixed- 
state analog of cloning. As already stated, the systems 
are also allowed to be correlated or entangled in such a 
way as to give the right marginal density operators. For 
instance, if the density operators Ps are diagonal in the 
same basis and have the spectral decomposition 



evolution of the form 



Pi 



= Y^Ps{b)\b){b\, 



(115) 



a set of potential broadcasting states are the highly cor- 
related joint states 



4 = ^P.(5)|6)|5)(5|(6|, 



(116) 



which, though not of the product form ps®Ps, reproduces 
the correct marginal density operators. 

The general problem, posed formally, is this. A quan- 
tum system AE is composed of two parts, A and E, each 
having an A'^-dimensional Hilbert space. System A is se- 
cretly prepared in one state from a set A={pq, pi} of two 
quantum states. System E, slated to receive the unknown 
state, is in a standard quantum state E. The initial state 
of the composite system AE is the product state ps (8) S, 
where s = or 1 specifies which state is to be broadcast. 
The question that is being asked is whether there is any 
physical process £ (as described in Section 2.1), consis- 
tent with the laws of quantum theory, that leads to an 



(117) 



where Rs is any state on the A^^-dimensional Hilbert 
space AE such that 



iY^(Rs) = Ps 



and 



tr^iRs 



Ps 



(118) 



If there is an £ that satisfies this for both po and pi , then 
the set A can be broadcast. A special case of broadcasting 
is the "cloning" evolution specified by 



£c{ps ®T.) ^ Ps® Ps 



(119) 



It turns out that despite Eve's best efforts, a physical 
evolution can lead to broadcasting if and only if pQ and 
pi commute In this way the concept of broadcast- 
ing makes a very nice communication theoretic cut be- 
tween commuting and noncommuting density operators; 
this is another way to express the cut between classical 
and quantum state descriptions.]^ It also turns out that 
A is clonable if and only if po f^nd pi are identical or 
orthogonal, i.e., popi = 

This result seems to indicate that a key component 
in an information-disturbance principle for mixed states 
will be the noncommutivity of the states in A, not their 
nonorthogonality. (For pure states, the properties of 
orthogonality and commutivity coincide.) The enticing 
mystery that arises from the no-broadcasting theorem is 
the following. Study of Eqs. (113) and (114) and their 
analogs in Ref. jl^ reveals that information can be gained 
about the identity of two pure quantum states without 
disturbance if and only if they are orthogonal. (Also see 
Rcfs. |lO) •) It follows that there can be information gain 
without disturbance if and only if the two pure states can 
be cloned. That is to say, we have the following logical 
relationship for pure states in A: 



^(info gain) => (disturbance)^ 



T (clonable) 



Because of this, the no-broadcasting theorem might lead 
one to expect an analogous logical relation to hold for 
mixed states, with broadcasting as the relevant concept. 
That is, one might expect that information can be gained 
without disturbance if and only if the two states can be 
broadcast. This thought, however, is misguided. Life 
again becomes interestingly more complex when it comes 
to mixed states. 

A simple example to consider is that of two density 
operators po and pi for which there is a basis in which 
both are block diagonal with identical blocks. That is 



^^This is a distinction that has only anpeared before in the Holevo 
bound to accessible information Eq. 1251): the bound is achieved by 
the accessible information if and only if the signal states commute. 
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to say, for illustration, each ps has a structure something 
hke: 
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Suppose furthermore that the density operators are non- 
commuting on each of these blocks. Thus po and pi them- 
selves are noncommuting, and it follows that the set A 
cannot be broadcast. 

However, if — depending upon the value of s — the trace 
of these blocks differ, so that, say, po is more likely to be 
in the "a" block than pi, etc., then it follows immediately 
that there are information gathering measurements that 
cause no disturbance to these states. The measurement 
POVM consists of a set of multidimensional projectors 
onto each of the blocks in the p^; this measurement can 
be performed as a quantum nondemolition measurement 
and yet reveals information about the identity because of 
the differing likelihoods of the outcomes. 

An interesting open question is the necessary and suffi- 
cient mathematical criteria required of two density oper- 
ators to insure that information gathering measurements 
necessarily disturb the quantum states. Securing this re- 
sult is surely the first step toward the formulation of a 
tradeoff principle for mixed states. 

6 Foundations 

To close the paper, we briefly sketch an observation hint- 
ing that the information-disturbance tradeoff principle it- 
self has something to say about the foundations of quan- 
tum theory. 

Let us return to the Hilbert space Ha He — the set- 
ting for so much of this paper — but, this time, with the 
conviction to play a new game. Suppose, for whatever 
reason, we believe all the standard quantum mechanical 
axioms sound and beyond question, except one. Namely, 
we hold suspect the structure of the general group of time 
evolutions to which this vector space may be submitted. 
Perhaps we are simply skeptics, or have always wanted a 
physical mechanism for wave function collapse in isolated 
systems, or have some other religious bent that leads us 
in this direction; the motivation is not all that important. 

To be relatively general at the outset, we might suppose 
that this group T consists of all maps continuous in time 
that are bijections of TLa^'He onto itself, and that it con- 
tains at least all the unitary operations. In particular, we 
may not wish to tie down the set of evolutions any further 



than this — it might contain other linear maps, nonlinear 
maps, maps discontinuous with respect to the topology of 
the vector space, or what have you. 

As it stands, not much can be said about the group T. 
So let us now ask what would be required of a mapping 
$ S T if it were to be capable of breaking the principles 
espoused in this paper. One thing that pops to mind is 
the following definition: 

A mapping $ is said to allow illegal eavesdrop- 
ping (i.e., information gain without disturbance) 
if there are two nonorthogonal states \s), s = 
0, 1, in Ha and a standard state \<t) in He such 
that|f] 

^{\s)\a))^\s)\a^), (121) 

where 

0<|(ao|ai)|<l. (122) 

Note that if such an illegal eavesdropping map were to 
exist, then — since all the other axioms of quantum me- 
chanics are still intact — an appropriate measurement on 
Eve's system alone (in principle well after the interac- 
tion) would be able to reveal information about the state 
\s) without disturbing it. This follows because the states 
|iTo) and jfJi) are distinct, and by more than just a phase. 
It would not be wise to base a quantum cryptographic 
system on the two states |0) and |1). 

Suppose now, however, having grown accustomed to the 
benefits of quantum cryptography, we find the existence 
of such maps simply too unbearable. We therefore take it 
as a principle that time evolutions corresponding to illegal 
eavesdropping cannot exist. The question is, can we still 
find time evolutions in T that are more general than those 
provided by the unitary group? 

This is not a completely trivial question: the exclusion 
of illegal eavesdropping maps from T looks to be a rather 
weak condition at first sight. In particular, the formu- 
lation of the eavesdropping maps given in the definition 
above concerns product states only. The set of product 
states on Ha ® He, however, is an infinitesimally small 
part of the total space. For instance, because of the gen- 
erality of T, one can easily imagine maps on Ha ®He 
that are perfectly well behaved on product states, doing 
just what we expect — i.e., preserving all inner products — 
even though their behavior goes completely awry on the 
set of entangled states. What is to keep these nonunitary 
maps from being left in T? 

It turns out that the group property of T, the fact that 
it is assumed to include the unitary group as a subgroup, 
and Wigner's famous theorem on symmetry operations 
1^ , |[ |4| are enough to do just this. If there is a map in 
T that allows the increase or decrease of the modulus of 
any inner product of two states in Ha ® He — it matters 

^''AU vectors in this definition are assumed normalized. 
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not whether they are product states or entangled states — 
then we can construct another map that will use that 
effect for illegal eavesdropping. Thus, if the information- 
disturbance tradeoff principle is to be upheld, T can only 
contain inner-product modulus preserving maps. And 
this, in fact, is the premise for Wigner's theorem. This 
theorem states that, allowing the possible redefinition of 
phase, all inner-product modulus preserving maps must 
be unitary or anti-unitary. If the maps are to be contin- 
uous in time, then they must be unitary. 

Now, to make this argument complete, let us show how 
to construct an illegal eavesdropping map from an arbi- 
trary time-continuous nonunitary map ^! on Ha ^Ti-E- 
Since 5* is not unitary, its action must decrease the inner 
product (modulus) of at least two states. Call them |(/)o) 
and and let 



(123) 



Then we can start out by picking any two states |0) and 
|1) on TLa with 

(0|1) = (0o|0i) (124) 



and any two states |(To) and \ai) on T-Le with 

{mi) 



(CTOICTI) 



(0|1) 



(125) 



Finally picking a standard state jcr) on He and letting Ui 
and Uf he any two unitary operators such that 



(126) 



and 



f//|0',) = |s)|a,), (127) 
we have all the tools we need for the job. Namely, the 



map 



^ = Uf o "ii o Ui 



(128) 



that is the composition of all the other maps, is an illegal 
eavesdropping map. Moreover, this map is in T because 
of its group property. 

This simple point demonstrates that there are things 
to be learned about quantum theory itself by observing 
how it can be used for communication and computation. 
The particular result here is not all that satisfactory in 
that almost all the structure of quantum mechanics was 
taken for granted at the outset. Moreover, we had to 
require that T contain at least the unitary maps before we 
could make any progress.]^ Nevertheless, it does provide 
food for thought about the directions to which quantum 
information theory can turn. 

^^If it increases any one inner product, then it must decrease 
another. See Ref. [ p3| . 

^^N. Gisin has pointed out that this particular assumption can be 
done away with by relyingmi the strengthened version of Wigner's 
theorem reported in Ref. fcd]. 



7 Appendix: Error Probability 

In this Appendix, the optimal probability of error Eq. ( |2^ ) 
is derived in a previously unpublished way. Previous 
derivations [^2|, |2^ have always relied on the fact that 
a decision problem was of the main concern; therefore 
the derivations have always taken the liberty of assuming 
that an optimal POVM for error probability need only 
have two outcomes. 

We start with an alternative way of writing the classical 
probability of error, Eq. (19) ji^, namely, 



PeiPo,Pi) = l-K{po,Pi) , (129) 



where 



b 

is the Kolmogorov variational distance |^8j. Therefore, 
finding the optimal value of Pe(PojPi) over all measure- 
ments is equivalent to finding the maximal value of the 
Kolmogorov variational distance. 

Using the explicit quantum mechanical forms for the 
probabilities of the outcomes the measurement {Eb] the 
Kolmogorov distance becomes 



K{po,Pi) = i ^ \TTiti{pfEb) - TTotrip^Eb) 
tr{tEb 



2 

b 

2 ^ 

b 



(131) 



This follows from the linearity of the trace and the def- 
inition of Eq. (pT]). Now let |7i) denote an orthonormal 
eigenbasis for T and let 7^ denote the associated eigenval- 
ues. Taking into account Eq. (|l^), we have 



Kipa,Pi) = 



2 

b 



N 



< 



li {li\Eb\l^ 



1=1 

N 



1 ^ 

-Y 

2 ^ 

i=l 

1=1 




(132) 



The last expression in this, however, is equal by definition 
to tr|f|. Thus we have, for all POVMs {£'(,}, 



i^(po,Pi) < itr|f| 



(133) 



To see that this upper bound can be achieved by some 
POVM, simply take the Eb to be the projectors onto an 
orthonormal eigenbasis of F. 
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